shop.galvanina.com - urlscan.io

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 5 HTTP transactions. The main IP is 217.61.51.61, located in Ponte San Pietro, Italy and belongs to ARUBA-ASN, IT. The main domain is shop.galvanina.com.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on March 31st 2021. Valid for: a year.

This is the only time shop.galvanina.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Alibaba (Online)

Domain & IP information

	IP Address		AS Autonomous System
1 6	217.61.51.61 217.61.51.61		31034 (ARUBA-ASN) (ARUBA-ASN)
5	1

6 217.61.51.61 (Ponte San Pietro, Italy) 1 redirects

ASN31034 (ARUBA-ASN, IT)
PTR: giove.imcnetwork.net

shop.galvanina.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	galvanina.com 1 redirects shop.galvanina.com	302 KB
5	1

	Domain	Requested by
6	shop.galvanina.com	1 redirects shop.galvanina.com
5	1

This site contains no links.

Subject Issuer	Validity	Valid
galvanina.com DigiCert TLS RSA SHA256 2020 CA1	`2021-03-31` - `2022-04-20`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://shop.galvanina.com/wp-content/uploads/2021/global/login.alibaba-com/88fo67qtrvk9gm4rf1gfilxu.php?tracelog=hd_signin&cid=
Frame ID: 81C39737C41CD18B3CE69C6926E072B9
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Alibaba Manufacturer Directory - Suppliers, Manufacturers, Exporters & Importers

Page URL History Show full URLs

https://shop.galvanina.com/wp-content/uploads/2021/global/login.alibaba-com/ HTTP 302
https://shop.galvanina.com/wp-content/uploads/2021/global/login.alibaba-com/88fo67qtrvk9gm4rf1gfilxu.ph... Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

5
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

302 kB
Transfer

303 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://shop.galvanina.com/wp-content/uploads/2021/global/login.alibaba-com/ HTTP 302
https://shop.galvanina.com/wp-content/uploads/2021/global/login.alibaba-com/88fo67qtrvk9gm4rf1gfilxu.php?tracelog=hd_signin&cid= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request 88fo67qtrvk9gm4rf1gfilxu.php Show response shop.galvanina.com/wp-content/uploads/2021/global/login.alibaba-com/ Redirect Chain https://shop.galvanina.com/wp-content/uploads/2021/global/login.alibaba-com/ https://shop.galvanina.com/wp-content/uploads/2021/global/login.alibaba-com/88fo67qtrvk9gm4rf1gfilxu.php?tracelog=hd_signin&cid=	4 KB 2 KB	22ms 21ms	Document text/html	217.61.51.61 ARUBA-ASN
General Check archive.org Show headers Download Go to Full URL https://shop.galvanina.com/wp-content/uploads/2021/global/login.alibaba-com/88fo67qtrvk9gm4rf1gfilxu.php?tracelog=hd_signin&cid= Protocol H2 Security TLS 1.3, , AES_256_GCM Server 217.61.51.61 Ponte San Pietro, Italy, ASN31034 (ARUBA-ASN, IT), Reverse DNS giove.imcnetwork.net Software Apache/2.4.29 (Ubuntu) / Resource Hash `79b8a51b84226b677dfcbf357cb6ab26b40c978f43a3aefec8ba2030a04f1e03` Request headers :method GET :authority shop.galvanina.com :scheme https :path /wp-content/uploads/2021/global/login.alibaba-com/88fo67qtrvk9gm4rf1gfilxu.php?tracelog=hd_signin&cid= pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br cookie PHPSESSID=c4u4b8k9dm97igps3u58rijbf5 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers date Fri, 01 Oct 2021 10:52:04 GMT server Apache/2.4.29 (Ubuntu) vary Accept-Encoding content-encoding gzip content-length 1622 content-type text/html; charset=UTF-8 Redirect headers date Fri, 01 Oct 2021 10:52:04 GMT server Apache/2.4.29 (Ubuntu) expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate pragma no-cache set-cookie PHPSESSID=c4u4b8k9dm97igps3u58rijbf5; path=/ location 88fo67qtrvk9gm4rf1gfilxu.php?tracelog=hd_signin&cid= content-length 0 content-type text/html; charset=UTF-8
GET H2	200	a.png shop.galvanina.com/wp-content/uploads/2021/global/login.alibaba-com/images/	47 KB 48 KB	21ms 21ms	Image image/png	217.61.51.61 ARUBA-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://shop.galvanina.com/wp-content/uploads/2021/global/login.alibaba-com/images/a.png Requested by Host: shop.galvanina.com URL: https://shop.galvanina.com/wp-content/uploads/2021/global/login.alibaba-com/88fo67qtrvk9gm4rf1gfilxu.php?tracelog=hd_signin&cid= Protocol H2 Security TLS 1.3, , AES_256_GCM Server 217.61.51.61 Ponte San Pietro, Italy, ASN31034 (ARUBA-ASN, IT), Reverse DNS giove.imcnetwork.net Software Apache/2.4.29 (Ubuntu) / Resource Hash `57797ef890664196895718f1e87f72b382e27fdc4d9200139f902ce9e7c54722` Request headers :path /wp-content/uploads/2021/global/login.alibaba-com/images/a.png pragma no-cache cookie PHPSESSID=c4u4b8k9dm97igps3u58rijbf5 accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority shop.galvanina.com referer https://shop.galvanina.com/wp-content/uploads/2021/global/login.alibaba-com/88fo67qtrvk9gm4rf1gfilxu.php?tracelog=hd_signin&cid= :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://shop.galvanina.com/wp-content/uploads/2021/global/login.alibaba-com/88fo67qtrvk9gm4rf1gfilxu.php?tracelog=hd_signin&cid= User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 01 Oct 2021 10:52:04 GMT last-modified Tue, 14 Sep 2021 10:42:24 GMT server Apache/2.4.29 (Ubuntu) accept-ranges bytes etag "bc75-5cbf23cb727fc" content-length 48245 content-type image/png
GET H2	200	b.jpg shop.galvanina.com/wp-content/uploads/2021/global/login.alibaba-com/images/	240 KB 241 KB	61ms 61ms	Image image/jpeg	217.61.51.61 ARUBA-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://shop.galvanina.com/wp-content/uploads/2021/global/login.alibaba-com/images/b.jpg Requested by Host: shop.galvanina.com URL: https://shop.galvanina.com/wp-content/uploads/2021/global/login.alibaba-com/88fo67qtrvk9gm4rf1gfilxu.php?tracelog=hd_signin&cid= Protocol H2 Security TLS 1.3, , AES_256_GCM Server 217.61.51.61 Ponte San Pietro, Italy, ASN31034 (ARUBA-ASN, IT), Reverse DNS giove.imcnetwork.net Software Apache/2.4.29 (Ubuntu) / Resource Hash `fbe7f4cd74e8c64ebda2dda0993ebcca191c6da66a476de7879d3e9532f23e52` Request headers :path /wp-content/uploads/2021/global/login.alibaba-com/images/b.jpg pragma no-cache cookie PHPSESSID=c4u4b8k9dm97igps3u58rijbf5 accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority shop.galvanina.com referer https://shop.galvanina.com/wp-content/uploads/2021/global/login.alibaba-com/88fo67qtrvk9gm4rf1gfilxu.php?tracelog=hd_signin&cid= :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://shop.galvanina.com/wp-content/uploads/2021/global/login.alibaba-com/88fo67qtrvk9gm4rf1gfilxu.php?tracelog=hd_signin&cid= User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 01 Oct 2021 10:52:04 GMT last-modified Tue, 14 Sep 2021 10:42:24 GMT server Apache/2.4.29 (Ubuntu) accept-ranges bytes etag "3bf10-5cbf23cb727fc" content-length 245520 content-type image/jpeg
GET H2	200	1.png shop.galvanina.com/wp-content/uploads/2021/global/login.alibaba-com/images/	11 KB 11 KB	61ms 61ms	Image image/png	217.61.51.61 ARUBA-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://shop.galvanina.com/wp-content/uploads/2021/global/login.alibaba-com/images/1.png Requested by Host: shop.galvanina.com URL: https://shop.galvanina.com/wp-content/uploads/2021/global/login.alibaba-com/88fo67qtrvk9gm4rf1gfilxu.php?tracelog=hd_signin&cid= Protocol H2 Security TLS 1.3, , AES_256_GCM Server 217.61.51.61 Ponte San Pietro, Italy, ASN31034 (ARUBA-ASN, IT), Reverse DNS giove.imcnetwork.net Software Apache/2.4.29 (Ubuntu) / Resource Hash `dabd1b453cba1ae3da462d9979fe892bba211fda0410db6a0b506dbf66be2ab4` Request headers :path /wp-content/uploads/2021/global/login.alibaba-com/images/1.png pragma no-cache cookie PHPSESSID=c4u4b8k9dm97igps3u58rijbf5 accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority shop.galvanina.com referer https://shop.galvanina.com/wp-content/uploads/2021/global/login.alibaba-com/88fo67qtrvk9gm4rf1gfilxu.php?tracelog=hd_signin&cid= :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://shop.galvanina.com/wp-content/uploads/2021/global/login.alibaba-com/88fo67qtrvk9gm4rf1gfilxu.php?tracelog=hd_signin&cid= User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 01 Oct 2021 10:52:04 GMT last-modified Tue, 14 Sep 2021 10:42:24 GMT server Apache/2.4.29 (Ubuntu) accept-ranges bytes etag "2b51-5cbf23cb7185c" content-length 11089 content-type image/png
GET H2	200	3.png shop.galvanina.com/wp-content/uploads/2021/global/login.alibaba-com/images/	611 B 658 B	61ms 61ms	Image image/png	217.61.51.61 ARUBA-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://shop.galvanina.com/wp-content/uploads/2021/global/login.alibaba-com/images/3.png Requested by Host: shop.galvanina.com URL: https://shop.galvanina.com/wp-content/uploads/2021/global/login.alibaba-com/88fo67qtrvk9gm4rf1gfilxu.php?tracelog=hd_signin&cid= Protocol H2 Security TLS 1.3, , AES_256_GCM Server 217.61.51.61 Ponte San Pietro, Italy, ASN31034 (ARUBA-ASN, IT), Reverse DNS giove.imcnetwork.net Software Apache/2.4.29 (Ubuntu) / Resource Hash `99ab40cec95ea0b8314c7f889b9e5f8b252c396cb507e513ca0e0bde627e0c5e` Request headers :path /wp-content/uploads/2021/global/login.alibaba-com/images/3.png pragma no-cache cookie PHPSESSID=c4u4b8k9dm97igps3u58rijbf5 accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority shop.galvanina.com referer https://shop.galvanina.com/wp-content/uploads/2021/global/login.alibaba-com/88fo67qtrvk9gm4rf1gfilxu.php?tracelog=hd_signin&cid= :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://shop.galvanina.com/wp-content/uploads/2021/global/login.alibaba-com/88fo67qtrvk9gm4rf1gfilxu.php?tracelog=hd_signin&cid= User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 01 Oct 2021 10:52:04 GMT last-modified Tue, 14 Sep 2021 10:42:24 GMT server Apache/2.4.29 (Ubuntu) accept-ranges bytes etag "263-5cbf23cb7185c" content-length 611 content-type image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Alibaba (Online)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster function| unhideBody

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			shop.galvanina.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: c4u4b8k9dm97igps3u58rijbf5

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

shop.galvanina.com
217.61.51.61
57797ef890664196895718f1e87f72b382e27fdc4d9200139f902ce9e7c54722
79b8a51b84226b677dfcbf357cb6ab26b40c978f43a3aefec8ba2030a04f1e03
99ab40cec95ea0b8314c7f889b9e5f8b252c396cb507e513ca0e0bde627e0c5e
dabd1b453cba1ae3da462d9979fe892bba211fda0410db6a0b506dbf66be2ab4
fbe7f4cd74e8c64ebda2dda0993ebcca191c6da66a476de7879d3e9532f23e52

shop.galvanina.com Open in urlscan Pro 217.61.51.61 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

5 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

302 kBTransfer

303 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

1 Cookies

Indicators

shop.galvanina.com Open in urlscan Pro
217.61.51.61 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

302 kB
Transfer

303 kB
Size

1
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!